A static scan of the published registry manifest at this exact version and hash. It is not a runtime claim: it says nothing about what the server does once installed.
| check | result | detail |
|---|---|---|
static-secrets | pass | declares no long-lived secret |
version-pinned | pass | every package pinned to an exact version |
source-published | pass | source published at https://github.com/letoribo/mcp-graphql-enhanced |
target-stable | pass | points at the same domain and package owner as 4.13.3 |
artifact-resolves | pass | every listed package version exists; its digest is in this claim |
unchanged-since-last-scan | pass | manifest unchanged since the previous scan |
| package | digest | built by |
|---|---|---|
npm @letoribo/mcp-graphql-enhanced@4.15.4 | sha512-b/cPLSMuPO+VffGX1X5t2mnztfW+L/+VsCn+KGeT8gqvAvUF16Lg7nIlv | no build provenance |
Pin your client to these exact versions (container images to the @sha256: digest) so what you run is what was scanned.
atpp-scan-2026-10a210db7bf7f8b382a6f73198bd7a07f4…The image on a README is only a pointer. What counts is this in-toto statement, signed with Ed25519 on our scan host (this server only holds the public key), bound to the hash of the exact registry manifest that was scanned. Envelope sha256 829d6b0b50b3d3f173b699d11e8190e0824df9b061b3e10aba37d0ac5ab33af2, listed in the day's signed manifest.
People install MCP servers by name. This badge tells them, on every scan, that io.github.letoribo/mcp-graphql-enhanced still reaches the same domain and package owner it was first published with (no listing swap), ships no default secret and is pinned. Paste one line into your README:
[](https://trust.redthreadsec.com/v/mcp/io.github.letoribo/mcp-graphql-enhanced)
It follows each daily re-scan, drops if a check fails and turns grey if the scan goes stale. On GitHub it lags by about 10 minutes (image cache).
Commit two files to your repo instead. Your README then renders without any request to Redthread, every change is a commit you review, and anyone can check the claim offline.
Download .atpp/badge.svg · Download .atpp/attestation.dsse.json
[](https://trust.redthreadsec.com/v/mcp/io.github.letoribo/mcp-graphql-enhanced)
Or from a terminal (verifies before it writes): python3 atpp.py badge io.github.letoribo/mcp-graphql-enhanced — https://github.com/bl014h/atpp.
pip install cryptography curl -sO https://raw.githubusercontent.com/bl014h/atpp/main/atpp.py python3 atpp.py verify io.github.letoribo/mcp-graphql-enhanced # or: python3 atpp.py verify path/to/your/repo
It checks the signature against a key pinned in the script, re-hashes the live registry manifest, checks the committed badge against the signed one, and checks the expiry. Genuine verify pages are only served from trust.redthreadsec.com — check the address bar.
